Source Code Analysis: What It Is, What It Finds, and How to Run It Free

What Source Code Analysis Actually Is

Source code analysis (also called static analysis, because the code is examined without executing it) parses your files into a structured representation, usually an abstract syntax tree, and checks that structure against rules. A rule might be as simple as "no string concatenation inside a database query call" or as involved as "this route handler writes state but has no authentication middleware anywhere in its chain."

That structural view is what separates analysis from search. Grep can find the word query; an analyzer knows whether the value inside it came from user input. The difference decides whether you get three real findings or three hundred false alarms.

It is also what separates analysis from code review. A reviewer brings judgment and context but gets tired, skims, and cannot hold 40,000 lines in working memory. An analyzer applies every rule to every line with identical attention on the first file and the last. You want both; you can only automate one.

The Four Layers of a Full Analysis

Most free tools cover exactly one layer, which is why teams end up with either a false sense of safety or a toolchain of five CLIs nobody keeps updated. The four layers fail differently: your code can be flawless while a dependency ships a critical CVE, and your dependencies can be clean while a live Stripe key sits in a config file.

What It Finds: Real Examples

The classic SAST finding, and still one of the most common in generated code, is user input interpolated straight into a query:

// ❌ BAD — user input reaches the database as code
const user = await db.query(
  `SELECT * FROM users WHERE email = '${req.body.email}'`
);

// ✅ GOOD — parameterized query, input stays data
const user = await db.query(
  'SELECT * FROM users WHERE email = $1',
  [req.body.email]
);

Secret detection catches the finding with the fastest path from "oops" to "incident":

// ❌ BAD — a live payment key in source code
const stripe = new Stripe('sk_live_51Hxxxxxxxxxxxxxxxxxxxx');

// ✅ GOOD — the key lives in the environment
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);

GitGuardian counted roughly 23 million new secrets leaked in public repositories in a single year, and a leaked key is often exploited within minutes of exposure, because attackers scan public code faster than humans read it.

Dependency scanning finds problems you did not write. A typical result: micromatch 4.0.5 in your lockfile is vulnerable to CVE-2024-4067, a regular expression denial of service, fixed in 4.0.8. No amount of reading your own code surfaces that; only a scan against the vulnerability database does.

Why "I'll Just Read the Code" Stopped Working

Manual review scaled when a developer wrote fifty deliberate lines a day. AI assistants changed the arithmetic: Cursor, Claude Code, Bolt, or Lovable can produce thousands of lines in a session, written confidently and never read by a human even once. Veracode's 2025 GenAI research found about 45 percent of AI-generated code introduced an OWASP Top 10 class flaw. The code compiles, the demo works, and the flaws are statistical, spread evenly through files nobody opens.

Automated analysis is the only review that scales at the speed the code is now produced. The practical shift: analysis stops being a pre-release ceremony and becomes something you run after every serious coding session, the way you run tests.

How to Run Source Code Analysis for Free

Route 1: assemble the open-source stack. Install a SAST engine (Semgrep or OpenGrep), a secret scanner (Gitleaks), and a dependency scanner (Trivy or npm audit), wire them into a script or CI job, and triage the combined output. Cost: zero. Price: a day of setup, four output formats to reconcile, and the ongoing job of keeping rulesets current.

Route 2: use an online source code analyzer that runs every layer in one pass. VibeDoctor's Vibe Check (vibedoctor.io) was built as exactly that: connect a repository and it runs 149+ checks across 21 diagnostic areas, covering all four layers plus AI-specific ones like registry verification of every import to catch hallucinated packages. Findings come back scored by severity with the file path and line number, so the output is a fix list, not a data dump. Free to sign up, and the full list of checks is public.

Whichever route you take, the discipline matters more than the tool: a scan that actually runs every week beats a stricter one that ran once in March.

What Static Analysis Cannot Catch

Honesty clause: source code analysis finds defined classes of weakness. It does not understand your business logic, so it cannot know that users should never see each other's invoices, that a discount should not go negative, or that your pricing math is wrong. It also cannot observe runtime behavior, which is what dynamic testing (DAST) and monitoring are for. Treat analysis as the automated floor under your quality, not the ceiling; it removes the known failure classes so human review and testing can concentrate on the logic only you understand.

FAQ